netdev - Re: [PATCH] tcp: Fixed a TFO server bug that crashed kernel by raw sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 19 Sep 2012 07:12:06 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Christoph Paasch <christoph.paasch@...ouvain.be>
Cc:	"H.K. Jerry Chu" <hkchu@...gle.com>, davem@...emloft.net,
	netdev@...r.kernel.org, ncardwell@...gle.com, edumazet@...gle.com
Subject: Re: [PATCH] tcp: Fixed a TFO server bug that crashed kernel by raw
 sockets

On Wed, 2012-09-19 at 02:19 +0200, Christoph Paasch wrote:

> Why not moving the TCP-code out of inet_sock_destruct by modifying the sk_destruct
> callback when TFO is in use? Like the below (only compile-tested) patch. That
> way inet_sock_destruct stays TFO-free.
> 
> 
> Cheers,
> Christoph
> 
> ---------
> 
> From: Christoph Paasch <christoph.paasch@...ouvain.be>
> Date: Wed, 19 Sep 2012 02:06:53 +0200
> Subject: [PATCH] Don't add TCP-code in inet_sock_destruct
> 
> Signed-off-by: Christoph Paasch <christoph.paasch@...ouvain.be>
> ---
>  include/linux/tcp.h |    4 ++++
>  net/ipv4/af_inet.c  |    2 --
>  net/ipv4/tcp.c      |    7 +++++++
>  3 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/tcp.h b/include/linux/tcp.h
> index ae46df5..67c789a 100644
> --- a/include/linux/tcp.h
> +++ b/include/linux/tcp.h
> @@ -574,6 +574,8 @@ static inline bool fastopen_cookie_present(struct tcp_fastopen_cookie *foc)
>  	return foc->len != -1;
>  }
>  
> +extern void tcp_sock_destruct(struct sock *sk);
> +
>  static inline int fastopen_init_queue(struct sock *sk, int backlog)
>  {
>  	struct request_sock_queue *queue =
> @@ -585,6 +587,8 @@ static inline int fastopen_init_queue(struct sock *sk, int backlog)
>  		    sk->sk_allocation);
>  		if (queue->fastopenq == NULL)
>  			return -ENOMEM;
> +
> +		sk->sk_destruct = tcp_sock_destruct;
>  		spin_lock_init(&queue->fastopenq->lock);

Yes, it seems much better, thanks !

Acked-by: Eric Dumazet <edumazet@...gle.com>



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html